Sysadmin Notes

Tag: Entra ID

  • How to Permanently Remove Soft-Deleted Microsoft 365 Users

    How to Permanently Remove Soft-Deleted Microsoft 365 Users

    When a Microsoft 365 user account is deleted, it is not immediately removed from the tenant. Instead, it is placed in the recycle bin as a soft-deleted object, allowing administrators to restore it if necessary.

    In some situations, such as cleanup operations, migrations, or testing environments, you may need to permanently remove these deleted accounts from Microsoft 365.

    This article shows how to list all soft-deleted users and permanently delete them using PowerShell.

    Connect to Microsoft 365

    Start an elevated PowerShell session and connect to Microsoft Online Services:

    Connect-MsolService

    You will be prompted to authenticate using an account with sufficient administrative permissions.

    List Soft-Deleted Users

    To display all users currently stored in the Microsoft 365 recycle bin, run:

    Get-MsolUser -All -ReturnDeletedUsers | Select DisplayName, UserPrincipalName, ObjectId | Format-Table

    Example output:

    DisplayName UserPrincipalName ObjectId
2
----------- ----------------- --------
3
John Smith ExRemoved-dc6d160412444218fa06dbf4692079042@tenant.onmicrosoft.com

    Review the list carefully before proceeding with permanent removal.

    Permanently Delete a Soft-Deleted User

    To purge a deleted user from Microsoft 365 and remove it from the recycle bin permanently:

    Remove-MsolUser -UserPrincipalName "userprincipalname" -RemoveFromRecycleBin -Force

    Example:

    Remove-MsolUser -UserPrincipalName ExRemoved-dc6d160412444218fa06dbf4692079042@mydomain.onmicrosoft.com -RemoveFromRecycleBin

    PowerShell will ask for confirmation:

    Confirm
2
Continue with this operation?
3
[Y] Yes [N] No [S] Suspend [?] Help (default is "Y"):

    Press Y to continue.

    Verify the User Has Been Removed

    After the deletion completes, verify that the account no longer exists in the recycle bin:

    Get-MsolUser -UserPrincipalName ExRemoved-dc6d160412444218fa06dbf4692079042@mydomain.onmicrosoft.com -ReturnDeletedUsers

    If the command returns no results, the user has been successfully and permanently removed.

    Important Notes

    • Permanent deletion cannot be undone.
    • Any remaining Azure AD object associated with the deleted account will be removed.
    • Always verify that the account is no longer required before purging it.
    • Consider exporting a list of soft-deleted users before performing bulk cleanup operations.

    Conclusion

    Soft-deleted Microsoft 365 users remain recoverable until they are permanently removed from the recycle bin. Using the MSOnline PowerShell module, administrators can quickly identify deleted users, permanently purge them, and verify the cleanup operation.

    This process is particularly useful during tenant maintenance, migration projects, and housekeeping activities where obsolete accounts must be fully removed.

  • BitLocker Encryption Not Starting on Surface Pro 9? Check WinRE Configuration

    BitLocker Encryption Not Starting on Surface Pro 9? Check WinRE Configuration

    Introduction

    When deploying a Microsoft Surface Pro 9, you may encounter a situation where BitLocker encryption does not start automatically, even though the device is correctly joined to the organization and all standard BitLocker requirements appear to be met.

    A common cause is that the Windows Recovery Environment (WinRE) is disabled or not properly configured. Without WinRE, Windows cannot proceed with automatic device encryption and BitLocker remains inactive.

    This article explains how to identify the issue and how to resolve it.

    Symptoms

    You may notice one or more of the following symptoms:

    • BitLocker encryption does not start automatically.
    • The device remains unencrypted several minutes after deployment.
    • No recovery key is uploaded to Microsoft Entra ID.
    • The BitLocker status shows encryption as pending or inactive.

    How to Verify the Cause

    Open Event Viewer and navigate to:

    Applications and Services Logs

└─ Microsoft
 └─ Windows
  └─ BitLocker-API
   └─ Management

    If WinRE is not configured correctly, you may find an event similar to the following:

    Failed to enable Silent Encryption.
WinRE is not configured.

Error:
This PC cannot support device encryption because WinRE is not properly configured.

    Resolution

    Open an elevated Command Prompt (Run as Administrator) and execute:

    reagentc /enable

    If the command succeeds, you should receive a confirmation similar to:

    REAGENTC.EXE: Operation Successful

    Verify WinRE Status

    You can confirm that WinRE has been enabled by running:

    reagentc /info

    A correctly configured system should display:

    Windows RE status: Enabled

    What Happens Next?

    After enabling WinRE:

    1. Wait a few minutes.
    2. Windows should automatically retry the device encryption process.
    3. BitLocker encryption should begin without requiring any further action.

    You can verify the encryption status by running:

    manage-bde -status

    Conclusion

    If BitLocker encryption is not starting on a Surface Pro 9, the issue may not be related to TPM, Intune policies, or Microsoft Entra ID. In some cases, the root cause is simply that Windows Recovery Environment (WinRE) is disabled.